I have three partitions: First one is Ventoy with a couple of distros per architecture. Partition two is a standard exfat partition for files. Partition three is a small fat16 partition, since there’s always that one device someone has (oscilloscope, 3D printer, UEFI/BIOS, etc.) that only supports very simple file systems. I’ve had to use the fat16 partition more than a couple of times and I don’t even work with legacy hardware.
Ultimately if a nation-state is after your data then strong encryption is your best bet. You can’t rely on any device-specific protections: Even if you had some system in place that prevents people from copying the data off a device without inputting a password, someone can just open it up, unsolder the NAND flash chips (or whatever else it uses) and read out their contents. The only thing you can reasonably do is make sure that your encrypted data can’t be brute forced easily.